[Snort-devel] Recreating a U2 file

Chris Wolski chris at ...3628...
Tue Dec 1 20:40:31 EST 2015


What is the best way to create a fresh unified2 file without restarting
snort?

My goal is to export the u2 files created by snort out to an external log
processor that is running barnyard2.  If I move the file, snort will not
create a new file unless I restart the snort instance.  I figure the best
way around this is to create a new u2 file with the same file name so that
snort continues plugging along.  This is necessary as a snort restart can
be timely depending on system load.

Thanks.

Chris
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20151201/3db14123/attachment.html>


More information about the Snort-devel mailing list